Medical Practice Application Requirements
Organizations that develop and operate applications for medical practices, commonly referred to as electronic medical record systems, must meet the following requirements to integrate with the ministry's health information exchange systems:
- Point of service applications will be hosted by an application service provider.
- Data hosting will meet privacy and security requirements.
- The application service provider solution will be connected to the provincial health sector network through the provincial extranet.
Electronic medical record systems (EMRs) must be hosted by an application service provider (ASP). EMRs not hosted by an ASP will not be permitted to connect to the ministry's health information exchange systems. An ASP provides network-based access to software services and involves:
- Remotely hosting a client's EMR system, application and data on its secured computer servers.
- Providing client access through a web browser or thin client.
- Professionally managing the servers and other related technologies.
- No client server hardware or software is required at the point of care.
Data Hosting Security
The Privacy and Security Conformance Standards (PDF, 649KB) includes the complete data hosting requirements needed to fully protect patient privacy and confidentiality and provide high quality service delivery. The following are examples of the requirements the ASP must include:
- Physical and environmental security measures including:
- Strong physical security perimeters, alarmed fire doors, and armoured windows;
- Entry and exit logs;
- Locks activated by keypads, swipe cards or equivalent;
- Intruder alarms;
- Security guards; and
- Recorded video surveillance.
- Commercial-grade firewalls and intrusion/detection systems.
- System monitoring and auditing for unauthorized access.
The application service provider solution must acquire and provide software service delivery over a dedicated TELUS circuit between the electronic medical record's data centre and the provincial extranet, which is an aggregation and access point into British Columbia's dedicated health sector network.
Review the latest release of the Conformance Standards.